From 1b0fdd7100eb63c6320ec82c1cf8cea4e2ea1acc Mon Sep 17 00:00:00 2001
From: Haseeb Ahmad <haseeb.ahmad@mapbox.com>
Date: Wed, 24 Jun 2026 12:30:06 +0200
Subject: [PATCH] CLOUDPLAT-3162: add npm OIDC publish workflow

https://mapbox.atlassian.net/browse/CLOUDPLAT-3162
---
 .github/workflows/npm-release.yml | 15 +++++++++++++++
 CONTRIBUTING.md                   | 24 ++++++++++++++++++++++++
 package.json                      |  5 ++++-
 3 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/npm-release.yml
 create mode 100644 CONTRIBUTING.md

diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
new file mode 100644
index 000000000..ba2ea448e
--- /dev/null
+++ b/.github/workflows/npm-release.yml
@@ -0,0 +1,15 @@
+name: NPM release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  npm-release:
+    uses: mapbox/gha-public/.github/workflows/workflow-npm-oidc-publish.yml@main
+    permissions:
+      id-token: write
+      contents: write
+    with:
+      create-github-release: true
+      environment: npm-release
+      run-tests: false
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 000000000..619ec9742
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,24 @@
+# Contributing to node-fontnik
+
+## Development
+
+```bash
+npm ci
+npm test
+```
+
+## Releasing a new version
+
+Releases are published to npm via GitHub Actions.
+
+### Steps
+
+1. **Bump the version** in `package.json` (follow [semver](https://semver.org))
+2. **Update `CHANGELOG.md`** with a summary of what changed
+3. **Open a PR**, get it reviewed and merged to `master`
+4. **Trigger the release** from the [Actions tab](../../actions/workflows/npm-release.yml):
+   - Select **NPM release** → **Run workflow** → run from `master`
+
+The workflow will publish to npm and create a GitHub release with auto-generated notes.
+
+> **Note:** Only Mapbox maintainers with write access to this repository can trigger the release workflow. External contributors can open and contribute to PRs, but releases are always cut by the owning team.
diff --git a/package.json b/package.json
index 1cb6ac0f4..b2d70215f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "fontnik",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "A library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protobuf.",
   "keywords": [
     "font",
@@ -56,5 +56,8 @@
   "binary": {
     "module_name": "fontnik",
     "module_path": "./lib/binding/"
+  },
+  "publishConfig": {
+    "access": "public"
   }
 }